@vellumai/assistant 0.6.5 → 0.7.0

package/src/permissions/gateway-threshold-reader.ts

@@ -0,0 +1,177 @@
+/**
+ * Gateway-backed auto-approve threshold reader.
+ *
+ * Reads thresholds from the gateway via IPC. The gateway is the sole source
+ * of truth for auto-approve thresholds. When the gateway is unreachable,
+ * defaults to "none" (Strict) so no tools are auto-approved without an
+ * explicit gateway-supplied threshold.
+ */
+
+import { ipcCall } from "../ipc/gateway-client.js";
+import { getLogger } from "../util/logger.js";
+import type { ExecutionContext } from "./approval-policy.js";
+
+const log = getLogger("gateway-threshold-reader");
+
+// ── Types ────────────────────────────────────────────────────────────────────
+
+type Threshold = "none" | "low" | "medium" | "high";
+
+interface GlobalThresholds {
+  interactive: string;
+  autonomous: string;
+}
+
+interface ConversationThreshold {
+  threshold: string;
+}
+
+// ── Global threshold cache (30s TTL) ─────────────────────────────────────────
+
+let cachedGlobalThresholds: GlobalThresholds | null = null;
+let cachedGlobalTimestamp = 0;
+const GLOBAL_CACHE_TTL_MS = 30_000;
+
+// ── Conversation threshold cache (5s TTL) ────────────────────────────────────
+// Shorter TTL than global because the user can change mid-conversation via the
+// picker UI, but still avoids a network roundtrip on every single tool call
+// within a burst.
+
+const conversationThresholdCache = new Map<
+  string,
+  { threshold: string | null; timestamp: number }
+>();
+const CONVERSATION_CACHE_TTL_MS = 5_000;
+
+/**
+ * Clear the global threshold cache. Exported for testing.
+ */
+export function _clearGlobalCacheForTesting(): void {
+  cachedGlobalThresholds = null;
+  cachedGlobalTimestamp = 0;
+  conversationThresholdCache.clear();
+}
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+function mapExecutionContextToField(
+  executionContext: ExecutionContext,
+): keyof GlobalThresholds {
+  if (executionContext === "conversation") return "interactive";
+  return "autonomous";
+}
+
+function isValidThreshold(value: string): value is Threshold {
+  return (
+    value === "none" ||
+    value === "low" ||
+    value === "medium" ||
+    value === "high"
+  );
+}
+
+// ── Main export ──────────────────────────────────────────────────────────────
+
+/**
+ * Read the auto-approve threshold from the gateway via IPC.
+ *
+ * For `"conversation"` context with a `conversationId`, checks for a
+ * per-conversation override first. Falls through to global defaults when
+ * the conversation override is absent.
+ *
+ * Caches global thresholds for 30 seconds to avoid hammering the gateway.
+ * On any IPC error or unexpected response, returns `"none"` (Strict) so
+ * no tools are silently auto-approved when the gateway is unreachable.
+ */
+export async function getAutoApproveThreshold(
+  conversationId: string | undefined,
+  executionContext?: ExecutionContext,
+): Promise<Threshold> {
+  const ctx: ExecutionContext = executionContext ?? "conversation";
+
+  // For conversation context with a conversationId, try per-conversation override first
+  if (ctx === "conversation" && conversationId) {
+    // Check cache first (5s TTL) — includes negative entries (no override)
+    const cached = conversationThresholdCache.get(conversationId);
+    if (cached && Date.now() - cached.timestamp < CONVERSATION_CACHE_TTL_MS) {
+      if (cached.threshold === null) {
+        // Negative cache hit — no override exists, fall through to global
+      } else if (isValidThreshold(cached.threshold)) {
+        return cached.threshold;
+      }
+    } else {
+      // ipcCall() returns undefined on transport failure (socket not found,
+      // timeout, etc.) and null when the gateway explicitly says "no override".
+      // On transport failure, fall through to the global threshold without
+      // poisoning the cache — a transient IPC failure must not cause subsequent
+      // approval checks to skip a real override for up to 5 seconds.
+      const result = (await ipcCall("get_conversation_threshold", {
+        conversationId,
+      })) as ConversationThreshold | null | undefined;
+
+      if (result === undefined) {
+        log.warn(
+          { conversationId },
+          "IPC call failed for conversation threshold override, falling through to global",
+        );
+        // Fall through to global threshold fetch below.
+      } else if (result && isValidThreshold(result.threshold)) {
+        conversationThresholdCache.set(conversationId, {
+          threshold: result.threshold,
+          timestamp: Date.now(),
+        });
+        return result.threshold;
+      } else {
+        // result === null (or an unexpected shape) — cache the negative result
+        // and fall through to global defaults.
+        conversationThresholdCache.set(conversationId, {
+          threshold: null,
+          timestamp: Date.now(),
+        });
+      }
+    }
+  }
+
+  // Fetch global thresholds (with 30s cache)
+  try {
+    const global = await fetchGlobalThresholds();
+    const field = mapExecutionContextToField(ctx);
+    const value = global[field];
+    if (isValidThreshold(value)) {
+      return value;
+    }
+    // Unexpected value from gateway — default to "none" (Strict).
+    log.warn({ field, value }, "Gateway returned unexpected threshold value, defaulting to none");
+    return "none";
+  } catch (err) {
+    // Gateway unreachable — default to "none" (Strict) so no tools are
+    // silently auto-approved when the gateway is down.
+    log.warn(
+      { error: String(err) },
+      "Failed to fetch global thresholds, defaulting to none",
+    );
+    return "none";
+  }
+}
+
+async function fetchGlobalThresholds(): Promise<GlobalThresholds> {
+  const now = Date.now();
+  if (
+    cachedGlobalThresholds &&
+    now - cachedGlobalTimestamp < GLOBAL_CACHE_TTL_MS
+  ) {
+    return cachedGlobalThresholds;
+  }
+
+  const result = (await ipcCall(
+    "get_global_thresholds",
+  )) as GlobalThresholds | null;
+
+  if (!result) {
+    throw new Error("Gateway IPC returned no result for global thresholds");
+  }
+
+  cachedGlobalThresholds = result;
+  cachedGlobalTimestamp = Date.now();
+  return result;
+}

package/src/permissions/ipc-risk-types.ts

@@ -0,0 +1,95 @@
+/**
+ * Types for gateway IPC risk classification.
+ *
+ * These types mirror the gateway's classify_risk IPC response shape
+ * (gateway/src/ipc/risk-classification-handlers.ts) and request parameters.
+ * Keep in sync when the gateway response evolves.
+ */
+
+import type { DirectoryScopeOption, ScopeOption } from "./risk-types.js";
+import type { AllowlistOption } from "./types.js";
+
+// ── Dangerous pattern (mirrors gateway wire format) ─────────────────────────
+
+export interface DangerousPattern {
+  type: string;
+  description: string;
+  text: string;
+}
+
+// ── Gateway response type ───────────────────────────────────────────────────
+
+/**
+ * The response returned by the gateway's `classify_risk` IPC method.
+ *
+ * Mirrors the `ClassificationResult` in
+ * `gateway/src/ipc/risk-classification-handlers.ts`.
+ */
+export interface ClassificationResult {
+  risk: "low" | "medium" | "high" | "unknown";
+  reason: string;
+  matchType: "user_rule" | "registry" | "unknown";
+  scopeOptions: ScopeOption[];
+  allowlistOptions?: AllowlistOption[];
+  directoryScopeOptions?: DirectoryScopeOption[];
+  resolvedPaths?: string[];
+  actionKeys?: string[];
+  commandCandidates?: string[];
+  dangerousPatterns?: DangerousPattern[];
+  opaqueConstructs?: boolean;
+  isComplexSyntax?: boolean;
+  sandboxAutoApprove?: boolean;
+}
+
+// ── Gateway request type ────────────────────────────────────────────────────
+
+/**
+ * File classifier context pre-resolved by the assistant and forwarded
+ * to the gateway so it can run file-risk classification without importing
+ * assistant-specific path helpers.
+ */
+export interface FileContext {
+  protectedDir: string;
+  deprecatedDir: string;
+  hooksDir: string;
+  actorTokenSigningKeyPath: string;
+  skillSourceDirs: string[];
+}
+
+/**
+ * Skill metadata pre-resolved by the assistant and forwarded to the
+ * gateway for skill-load risk classification.
+ */
+export interface SkillMetadata {
+  skillId: string;
+  selector: string;
+  versionHash: string;
+  transitiveHash?: string;
+  hasInlineExpansions: boolean;
+  isDynamic: boolean;
+}
+
+/**
+ * Parameters for the `classify_risk` IPC request.
+ *
+ * Mirrors the Zod schema in
+ * `gateway/src/ipc/risk-classification-handlers.ts`.
+ */
+export interface ClassifyRiskParams {
+  tool: string;
+  command?: string;
+  url?: string;
+  path?: string;
+  skill?: string;
+  mode?: string;
+  script?: string;
+  workingDir?: string;
+  workspaceRoot?: string;
+  allowPrivateNetwork?: boolean;
+  networkMode?: string;
+  isContainerized?: boolean;
+  fileContext?: FileContext;
+  skillMetadata?: SkillMetadata;
+  /** Tool registry default risk level for unknown tools. */
+  registryDefaultRisk?: string;
+}

package/src/permissions/prompter.ts

@@ -20,7 +20,6 @@ interface PendingPrompt {
   reject: (reason: Error) => void;
   timer: ReturnType<typeof setTimeout>;
   toolUseId?: string;
-  hostAccessEnablePrompt?: boolean;
 }
 
 export type ConfirmationStateCallback = (
@@ -63,9 +62,10 @@ export class PermissionPrompter {
     executionTarget?: ExecutionTarget,
     persistentDecisionsAllowed?: boolean,
     signal?: AbortSignal,
-    temporaryOptionsAvailable?: Array<"allow_10m" | "allow_conversation">,
     toolUseId?: string,
-    hostAccessEnablePrompt?: boolean,
+    riskReason?: string,
+    isContainerized?: boolean,
+    directoryScopeOptions?: readonly { scope: string; label: string }[],
   ): Promise<{
     decision: UserDecision;
     selectedPattern?: string;
@@ -96,7 +96,6 @@ export class PermissionPrompter {
         reject,
         timer,
         toolUseId,
-        hostAccessEnablePrompt,
       });
 
       if (signal) {
@@ -116,6 +115,8 @@ export class PermissionPrompter {
         toolName,
         input: redactSensitiveFields(input),
         riskLevel,
+        riskReason,
+        isContainerized,
         allowlistOptions: allowlistOptions.map((o) => ({
           label: o.label,
           description: o.description,
@@ -125,11 +126,13 @@ export class PermissionPrompter {
           label: o.label,
           scope: o.scope,
         })),
+        directoryScopeOptions: directoryScopeOptions
+          ? directoryScopeOptions.map((o) => ({ scope: o.scope, label: o.label }))
+          : undefined,
         diff,
         conversationId,
         executionTarget,
         persistentDecisionsAllowed: persistentDecisionsAllowed ?? true,
-        temporaryOptionsAvailable,
         toolUseId,
       });
 
@@ -151,10 +154,6 @@ export class PermissionPrompter {
     return this.pending.get(requestId)?.toolUseId;
   }
 
-  isHostAccessEnablePrompt(requestId: string): boolean {
-    return this.pending.get(requestId)?.hostAccessEnablePrompt === true;
-  }
-
   resolveConfirmation(
     requestId: string,
     decision: UserDecision,

package/src/permissions/risk-types.ts

@@ -1,15 +1,11 @@
 /**
- * Types for the data-driven command risk classifier.
+ * Shared risk assessment types used by the permission checker.
  *
- * All types are JSON-serializable — no native RegExp, no function references.
- * Regex patterns are stored as strings (use `String.raw` for ergonomics in TS).
- * This constraint exists because the registry will eventually be persisted to a
- * DB with per-user/per-org overrides that need to round-trip cleanly.
- *
- * @see /docs/bash-risk-classifier-design.md
+ * Classifier-internal types (CommandRiskSpec, ArgRule, ArgSchema, etc.) have
+ * been migrated to the gateway and removed from the assistant.
  */
 
-import { type AllowlistOption, RiskLevel } from "./types.js";
+import type { AllowlistOption } from "./types.js";
 
 // ── Risk levels ──────────────────────────────────────────────────────────────
 
@@ -23,12 +19,6 @@ import { type AllowlistOption, RiskLevel } from "./types.js";
  */
 export type Risk = "low" | "medium" | "high" | "unknown";
 
-/**
- * Risk levels that can be assigned to commands in the registry.
- * Excludes "unknown" — that's a classifier output, not a registry value.
- */
-export type RegistryRisk = "low" | "medium" | "high";
-
 // ── Risk assessment output ───────────────────────────────────────────────────
 
 /** A scope option presented to the user when classifying an unknown command. */
@@ -39,6 +29,17 @@ export interface ScopeOption {
   label: string;
 }
 
+/**
+ * A directory scope option emitted by the gateway for filesystem operations.
+ * Mirrors `DirectoryScopeOption` in `gateway/src/risk/risk-types.ts`.
+ */
+export interface DirectoryScopeOption {
+  /** Path glob (e.g. "/workspace/scratch/*") or the sentinel "everywhere". */
+  scope: string;
+  /** Human-readable label (e.g. "In scratch/"). */
+  label: string;
+}
+
 /**
  * The output of a risk classifier. Tool-agnostic — every classifier
  * (bash, file_write, web_fetch, etc.) produces this same shape.
@@ -59,147 +60,17 @@ export interface RiskAssessment {
    * directly instead of calling the per-tool strategy function.
    */
   allowlistOptions?: AllowlistOption[];
-}
-
-// ── Classifier interface ─────────────────────────────────────────────────────
-
-/**
- * Generic risk classifier interface. Each tool type (bash, file_write, etc.)
- * implements this with a tool-specific input type.
- */
-export interface RiskClassifier<TInput> {
-  classify(input: TInput): Promise<RiskAssessment>;
-}
-
-// ── Bash classifier input ────────────────────────────────────────────────────
-
-/** Input to the bash risk classifier. */
-export interface BashClassifierInput {
-  /** The raw command string. */
-  command: string;
-  /** Which tool is being invoked. */
-  toolName: "bash" | "host_bash";
-  /** Working directory (for path resolution in arg rules). */
-  workingDir?: string;
-}
-
-// ── Command registry types ───────────────────────────────────────────────────
-
-/**
- * A single arg-level risk rule within a command spec.
- *
- * Evaluated per arg token. If `flags` is set, the rule only fires when the
- * arg matches one of those flags. If `valuePattern` is set, the arg (or the
- * flag's consumed value) must match the regex.
- */
-export interface ArgRule {
-  /**
-   * Stable ID for DB references, partial overrides, and audit trails.
-   * Convention: `"command:descriptor"` (e.g. `"curl:upload-file"`, `"rm:recursive-force"`).
-   */
-  id: string;
   /**
-   * Flag(s) that trigger this rule. Omit for positional/any-arg matching.
-   * Combined short flags are listed as literals (e.g. `"-rf"`, `"-fr"`).
+   * Directory scope options emitted by the gateway for filesystem operations.
+   * Mirrors `directoryScopeOptions` in the gateway's ClassificationResult.
+   * Present when the gateway's classifier identified one or more filesystem
+   * path arguments and generated a directory-scope ladder for them.
    */
-  flags?: string[];
+  directoryScopeOptions?: DirectoryScopeOption[];
   /**
-   * Regex string matched against the arg value. Omit if flag presence alone
-   * triggers the rule. Stored as a string (not a native RegExp) for JSON
-   * serialization.
+   * Fully resolved filesystem path arguments from the gateway classifier.
+   * Threaded into `findHighestPriorityRule` so directory-scoped trust rules
+   * match against actual target paths, not just the working directory.
    */
-  valuePattern?: string;
-  /** Risk level when this rule fires. */
-  risk: RegistryRisk;
-  /** Human-readable reason (shown in permission prompt). */
-  reason: string;
-}
-
-/**
- * Risk specification for a single command (or subcommand).
- *
- * The registry is a `Record<string, CommandRiskSpec>` mapping program names
- * to their specs. Subcommands nest recursively.
- */
-export interface CommandRiskSpec {
-  /** Base risk when no arg rules match. */
-  baseRisk: RegistryRisk;
-  /**
-   * Subcommand-level overrides. Keys are subcommand names
-   * (e.g. `{ push: { baseRisk: "medium", ... } }` under `git`).
-   * Subcommands can nest further (e.g. `git stash drop`).
-   */
-  subcommands?: Record<string, CommandRiskSpec>;
-  /** Arg-level rules, evaluated per arg. First match per arg wins. */
-  argRules?: ArgRule[];
-  /**
-   * Is this a wrapper command? (sudo, env, nice, etc.)
-   * When true, the classifier unwraps to find the inner command and
-   * takes the max of the wrapper's baseRisk and the inner command's risk.
-   */
-  isWrapper?: boolean;
-  /**
-   * Flags that put a wrapper into a non-exec mode (e.g. command -v, env -0).
-   * When the first arg matches a non-exec flag, skip unwrapping and classify
-   * the wrapper standalone against its own arg rules.
-   */
-  nonExecFlags?: string[];
-  /**
-   * Does this command have non-standard syntax where intermediate scope
-   * options would be confusing? (find, xargs, awk, etc.)
-   * When true, the scope ladder only offers exact match and command-level wildcard.
-   */
-  complexSyntax?: boolean;
-  /** Human-readable reason for the base risk (shown when no arg rule matches). */
-  reason?: string;
-  /**
-   * Global flags that consume the next token as a value (e.g. git -C <path>).
-   * Used by resolveSubcommand to skip past flag-value pairs when locating the
-   * first positional arg (the subcommand name).
-   */
-  globalValueFlags?: string[];
-}
-
-// ── User rule types ──────────────────────────────────────────────────────────
-
-/**
- * A user-created risk classification rule.
- *
- * Created via the scope ladder UI (from permission prompts) or manually
- * in settings. Stored in the user's DB.
- */
-export interface UserRule {
-  /** Auto-generated unique ID. */
-  id: string;
-  /** Regex pattern (converted from glob at creation time). */
-  pattern: string;
-  /** User-assigned risk level. */
-  risk: RegistryRisk;
-  /** Human-readable label (shown in settings UI). */
-  label: string;
-  /** ISO 8601 timestamp of when the rule was created. */
-  createdAt: string;
-  /** How the rule was created. */
-  source: "scope_ladder" | "manual";
-}
-
-// ── Risk → RiskLevel mapping ─────────────────────────────────────────────────
-
-/**
- * Map a classifier `Risk` value to the permission system's `RiskLevel` enum.
- *
- * `"unknown"` maps to `RiskLevel.Medium` — matching the existing checker.ts
- * behavior where unrecognized commands are treated as medium-risk.
- */
-export function riskToRiskLevel(risk: Risk): RiskLevel {
-  switch (risk) {
-    case "low":
-      return RiskLevel.Low;
-    case "medium":
-      return RiskLevel.Medium;
-    case "high":
-      return RiskLevel.High;
-    case "unknown":
-      return RiskLevel.Medium;
-  }
+  resolvedPaths?: string[];
 }

package/src/permissions/types.ts

@@ -1,43 +1,26 @@
-import type { TrustRuleBase } from "@vellumai/ces-contracts";
-
-/**
- * Re-exported TrustRule type from `@vellumai/ces-contracts`.
- *
- * The contracts package defines `TrustRule` as a discriminated union over tool
- * families (scoped, URL, managed-skill, skill-load, generic). Some variants
- * don't carry `executionTarget`. To maintain backward
- * compatibility with existing callsites that access those fields on any rule,
- * we flatten the union here by intersecting the base with the optional fields.
- */
-export type TrustRule = TrustRuleBase & {
+export type {
+  AllowlistOption,
+  ScopeOption,
+} from "@vellumai/skill-host-contracts";
+export { RiskLevel } from "@vellumai/skill-host-contracts";
+
+/** A persistent trust rule stored on disk and used for permission matching. */
+export interface TrustRule {
+  id: string;
+  tool: string;
+  pattern: string;
+  decision: "allow" | "deny" | "ask";
+  priority: number;
+  createdAt: number;
   scope?: string;
   executionTarget?: string;
-};
-
-export enum RiskLevel {
-  Low = "low",
-  Medium = "medium",
-  High = "high",
+  userModifiedAt?: number;
 }
 
-export type UserDecision =
-  | "allow"
-  | "allow_10m"
-  | "allow_conversation"
-  | "always_allow"
-  | "deny"
-  | "always_deny"
-  | "temporary_override";
+export type UserDecision = "allow" | "deny";
 
-/** Returns true for any allow-variant decision. Centralizes the check to prevent omissions when new allow variants are added. */
 export function isAllowDecision(decision: UserDecision): boolean {
-  return (
-    decision === "allow" ||
-    decision === "allow_10m" ||
-    decision === "allow_conversation" ||
-    decision === "always_allow" ||
-    decision === "temporary_override"
-  );
+  return decision === "allow";
 }
 
 export interface PermissionCheckResult {
@@ -46,22 +29,9 @@ export interface PermissionCheckResult {
   matchedRule?: TrustRule;
 }
 
-export interface AllowlistOption {
-  label: string;
-  description: string;
-  pattern: string;
-}
-
-export interface ScopeOption {
-  label: string;
-  scope: string;
-}
-
 /** Contextual information passed alongside a permission check for policy decisions. */
 export interface PolicyContext {
   executionTarget?: string;
-  /** Ephemeral rules for task-scoped permissions — checked before persistent trust.json rules. */
-  ephemeralRules?: TrustRule[];
   /**
    * Execution context for per-context threshold resolution.
    * - "conversation": interactive client session (default)
@@ -69,4 +39,6 @@ export interface PolicyContext {
    * - "headless": non-interactive non-guardian session
    */
   executionContext?: "conversation" | "background" | "headless";
+  /** Conversation ID for per-conversation threshold overrides. */
+  conversationId?: string;
 }

package/src/permissions/workspace-policy.ts

@@ -1,6 +1,8 @@
 import { realpathSync } from "node:fs";
 import { basename, dirname, normalize, resolve } from "node:path";
 
+import { getIsContainerized } from "../config/env-registry.js";
+
 /**
  * Resolve a path to its canonical form. When the target itself doesn't
  * exist (e.g. a new file being written), walk up to the nearest existing
@@ -61,14 +63,12 @@ const HOST_TOOLS = new Set([
   "host_file_read",
   "host_file_write",
   "host_file_edit",
+  "host_file_transfer",
   "host_bash",
   "computer_use_run_applescript",
 ]);
 
-/**
- * Check whether a tool name is a host-level tool that requires the
- * `hostAccess` permission to execute.
- */
+/** Check whether a tool name is a host-level tool. */
 export function isHostTool(toolName: string): boolean {
   return HOST_TOOLS.has(toolName);
 }
@@ -112,9 +112,12 @@ export function isWorkspaceScopedInvocation(
     );
   }
 
-  // Bash is generally workspace-scoped when sandbox isolation is active —
-  // the caller handles network mode checks separately.
-  if (toolName === "bash") return true;
+  // Bash workspace scope depends on the environment: containerized bash has the
+  // entire filesystem as workspace, so it's always workspace-scoped. Non-containerized
+  // bash is NOT workspace-scoped here — path resolution for allowlisted commands is
+  // handled upstream in the checker's hasSandboxAutoApprove computation, which validates
+  // all path arguments against the workspace root for non-containerized environments.
+  if (toolName === "bash") return getIsContainerized();
 
   // Unknown tool — conservative default.
   return false;

package/src/playbooks/playbook-compiler.ts

@@ -6,7 +6,7 @@
 
 import { and, eq, sql } from "drizzle-orm";
 
-import { getDb } from "../memory/db.js";
+import { getDb } from "../memory/db-connection.js";
 import { memoryGraphNodes } from "../memory/schema.js";
 import type { Playbook } from "./types.js";
 import { parsePlaybookStatement } from "./types.js";